org.apache.activemq:activemq-broker 5.19.7

Direct Vulnerabilities

Known vulnerabilities in the org.apache.activemq:activemq-broker package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M External Control of System or Configuration Setting org.apache.activemq:activemq-broker is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Affected versions of this package are vulnerable to External Control of System or Configuration Setting in the `LdapNetworkConnector` process. An attacker can instantiate unauthorized transports and trigger the creation of an additional broker service within the same JVM by publishing or modifying LDAP entries that match the configured `searchBase` and `searchFilter`. How to fix External Control of System or Configuration Setting? Upgrade `org.apache.activemq:activemq-broker` to version 5.19.8, 6.2.7 or higher.	[,5.19.8)[6.0.0,6.2.7)
H Memory Allocation with Excessive Size Value org.apache.activemq:activemq-broker is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the unmarshalling process of OpenWire message property maps without proper size validation. An attacker can exhaust system memory and cause a broker crash by sending a crafted message with a large encoded size value. How to fix Memory Allocation with Excessive Size Value? Upgrade `org.apache.activemq:activemq-broker` to version 5.19.8, 6.2.7 or higher.	[,5.19.8)[6.0.0,6.2.7)
M Missing Authorization org.apache.activemq:activemq-broker is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Affected versions of this package are vulnerable to Missing Authorization in the process that manages temporary destinations. An attacker can gain unauthorized access to consume messages from another user's temporary destination by establishing a separate connection and bypassing client-side isolation checks. How to fix Missing Authorization? Upgrade `org.apache.activemq:activemq-broker` to version 5.19.8, 6.2.7 or higher.	[,5.19.8)[6.0.0,6.2.7)
H Allocation of Resources Without Limits or Throttling org.apache.activemq:activemq-broker is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the `OpenWire` process. An attacker can exhaust system memory by repeatedly sending `BrokerInfo` commands without a corresponding `ConnectionInfo`, ultimately causing the broker to crash. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `org.apache.activemq:activemq-broker` to version 5.19.8, 6.2.7 or higher.	[5.19.7,5.19.8)[6.2.6,6.2.7)

Vulnerability

Vulnerable Version

External Control of System or Configuration Setting

org.apache.activemq:activemq-broker is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation.

Affected versions of this package are vulnerable to External Control of System or Configuration Setting in the LdapNetworkConnector process. An attacker can instantiate unauthorized transports and trigger the creation of an additional broker service within the same JVM by publishing or modifying LDAP entries that match the configured searchBase and searchFilter.

How to fix External Control of System or Configuration Setting?

Upgrade org.apache.activemq:activemq-broker to version 5.19.8, 6.2.7 or higher.

[,5.19.8)[6.0.0,6.2.7)

Memory Allocation with Excessive Size Value

org.apache.activemq:activemq-broker is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation.

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the unmarshalling process of OpenWire message property maps without proper size validation. An attacker can exhaust system memory and cause a broker crash by sending a crafted message with a large encoded size value.

How to fix Memory Allocation with Excessive Size Value?

Upgrade org.apache.activemq:activemq-broker to version 5.19.8, 6.2.7 or higher.

[,5.19.8)[6.0.0,6.2.7)

Missing Authorization

org.apache.activemq:activemq-broker is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation.

Affected versions of this package are vulnerable to Missing Authorization in the process that manages temporary destinations. An attacker can gain unauthorized access to consume messages from another user's temporary destination by establishing a separate connection and bypassing client-side isolation checks.

How to fix Missing Authorization?

Upgrade org.apache.activemq:activemq-broker to version 5.19.8, 6.2.7 or higher.

[,5.19.8)[6.0.0,6.2.7)

Allocation of Resources Without Limits or Throttling

org.apache.activemq:activemq-broker is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the OpenWire process. An attacker can exhaust system memory by repeatedly sending BrokerInfo commands without a corresponding ConnectionInfo, ultimately causing the broker to crash.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade org.apache.activemq:activemq-broker to version 5.19.8, 6.2.7 or higher.

[5.19.7,5.19.8)[6.2.6,6.2.7)

org.apache.activemq:activemq-broker@5.19.7

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically